Current: Apache CVE-2026-119618

WordPress security warnings

If the host runs Apache with HTTP/2, ask whether CVE-2026-119618 is fixed and whether Apache was restarted. A WordPress update does not patch it.

Current warnings

Nov 12, 2026 Current
Apache CVE-2026-119618 Apache HTTP Server 2.4.55 through 2.4.70 can run attacker code if HTTP/2 is on, CVE-2026-119618. The upstream fix is 2.4.71. A WordPress update does not patch Apache. Read the warning
Nov 10, 2026 Current
WPML CVE-2026-76877 WPML 4.9.7 and older has an unauthenticated login bypass in language-per-domain SSO, CVE-2026-76877. No official patch yet. If each language uses its own domain, turn off auto sign-in across domains. Read the warning
Nov 9, 2026 Current
WP Duplicate CVE-2026-123751 WP Duplicate, the migration plugin in folder local-sync, through 1.1.11 lets someone who is not logged in upload a file and run code. CVE-2026-123751. No patch. This is not Duplicator. Read the warning
Nov 2, 2026 Current
s2Member CVE-2026-86596 s2Member 260927 and older has a critical remote code execution bug, CVE-2026-86596. Attacks were recorded on Nov 2, 2026. Update to 261001. Read the warning
Oct 28, 2026 Current
WordPress 7.1.4 security release WordPress 7.1.4 is a short-cycle security release. Update sites now. Older branches got the same fixes, through 4.7. PHP2Shell is a separate PHP update. Read the warning
Oct 22, 2026 Current
PHP2Shell: CVE-2026-109618 and CVE-2026-109619 PHP2Shell is CVE-2026-109618 and CVE-2026-109619. Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. A WordPress update does not fix it. Read the warning

Pro adds a cloud firewall, malware scanning, and login protection. 14 days. Card or PayPal, not charged today.

Start 14-day Pro trial

All warnings

Search by plugin, theme, CVE, or the name people use, such as PHP2Shell.